Across Protocol's Solana Bridge Hit for $3.35M — Relayer, Not Users, Took the Loss

What happened

On 17 July 2026, at around 05:30 UTC, Across Protocol's Solana deployment was exploited for approximately $3.35 million. Across confirmed the incident on Twitter and has since disabled deposits into Solana as a containment measure while the rest of the protocol continues to operate. Per the project's own account, this is the first publicly disclosed attack against Across since it launched in 2021, over which time it has processed more than $34 billion in cross-chain bridge volume.

Why the loss landed on Across, not its users

Across runs an intent-based bridge model: independent relayers front capital on the destination chain so a user's transfer completes instantly, and are reimbursed afterward through an Ethereum-settled process that leans on UMA's optimistic oracle. Relayers are permissionless participants — anyone can run one — but in this case the attacker's inflows were traced to a relayer operated by Risk Labs, the foundation that backs the project, rather than to a third-party relayer or the bridge's user-facing contracts.

That distinction is why Across says no user funds were lost: all Solana transfers already in flight at the time of the attack were completed or refunded, and the loss was contained to the relayer's own operating capital. It is a useful, concrete illustration of a design goal bridge teams talk about often and rarely get to demonstrate under real attack conditions — isolating the blast radius of a single compromised component from the funds of everyone else using the system.

An unresolved root cause, and a familiar Solana wrinkle

Across has not yet published a root-cause finding, and reporting on the incident has flagged three plausible vectors rather than a confirmed one: a class of event-spoofing bug specific to Solana's architecture, a flaw in the relayer's off-chain bot infrastructure, or a compromised private key. The event-spoofing angle is worth flagging on its own: Solana lacks the kind of canonical, contract-verified event log that EVM chains provide, and a prior vulnerability in Across's SVM spoke pool — disclosed in April 2026 — allowed deposit events to be spoofed on that basis. Whether this incident is a variant of that same issue, an infrastructure bug, or key compromise is exactly what Across's promised post-mortem needs to settle; until it does, treating this as "a relayer bug" versus "a key compromise" versus "a Solana event-verification gap" are three very different lessons for anyone else running relayer or oracle-settled infrastructure on non-EVM chains.

What this means for teams operating bridge or relayer infrastructure

• Segregating relayer capital from user-custodied funds is not just a compliance nicety — it is the control that determined whether this was a $3.35 million operator loss or a user-facing bridge hack.
• Non-EVM chains without canonical, verifiable event logs need their own threat model for message and deposit verification; don't assume patterns proven safe on Ethereum transfer cleanly to Solana program design.
• Off-chain relayer bots and the keys that operate them are part of the attack surface, not an implementation detail — they deserve the same key-management and infrastructure scrutiny as the on-chain contracts.

Across says a detailed report on the incident's cause is coming; until it lands, the immediate operational fact — deposits paused, users unaffected, losses confined to the project's own relayer — is the most that can be said with confidence.

FAQ